{"api_version":"1","generated_at":"2026-11-02T10:03:14+00:00","cve":"CVE-2024-5617","urls":{"html":"https://cve.report/CVE-2024-5617","api":"https://cve.report/api/cve/CVE-2024-5617.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2024-5617","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2024-5617"},"summary":{"title":"Account Lock Bypass via User Store Synchronization in Multiple WSO2 Products Allows Brute Force Attacks","description":"The account lock feature fails to correctly enforce account lockouts on the primary user store when users with identical usernames exist in both primary and secondary user stores. This occurs because the lock condition is only applied to the secondary user store account in such scenarios, allowing continued authentication attempts against the primary user store account.\n\nThis functional flaw enables brute force attacks. By systematically attempting different passwords against the primary user store account, an attacker can potentially gain unauthorized access to sensitive information or accounts, as the intended account lockout mechanism does not prevent repeated login attempts.","state":"PUBLISHED","assigner":"WSO2","published_at":"2026-11-02 06:17:41","updated_at":"2026-11-02 06:17:41"},"problem_types":["CWE-799","CWE-799 CWE-799: Improper Neutralization of Input During Action Execution ('Code Injection')"],"metrics":[{"version":"3.1","source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","type":"Secondary","score":"4.8","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"4.8","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","data":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"}}],"references":[{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3414/","name":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3414/","refsource":"ed10eef1-636d-4fbe-9993-6890dfa878f8","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-5617","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-5617","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"unknown 4.0.0 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 4.0.0 4.0.0.298 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 4.2.0 4.2.0.95 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 4.3.0 4.3.0.13 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server","version":"unknown 5.11.0 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server","version":"affected 5.11.0 5.11.0.348 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server","version":"affected 6.0.0 6.0.0.194 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server","version":"affected 6.1.0 6.1.0.162 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server","version":"affected 7.0.0 7.0.0.33 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity Management","version":"affected 5.18.187 5.18.187.259 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity Management","version":"affected 5.23.8 5.23.8.180 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity Management","version":"affected 5.24.8 5.24.8.5 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity Management","version":"affected 5.25.92 5.25.92.84 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity Management","version":"affected 5.25.705 5.25.705.5 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity Management","version":"affected 7.0.78 7.0.78.19 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon User Manager Kernel","version":"affected 4.6.1 4.6.1.114 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon User Manager Kernel","version":"affected 4.7.1 4.7.1.53 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon User Manager Kernel","version":"affected 4.8.1 4.8.1.16 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon User Manager Kernel","version":"affected 4.9.0 4.9.0.58 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon User Manager Kernel","version":"affected 4.9.26 4.9.26.7 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon User Manager Kernel","version":"affected 4.10.9 4.10.9.17 custom","platforms":[]}],"timeline":[],"solutions":[{"source":"CNA","title":"","value":"Follow the instructions given on  https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3414/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3414/#solution","time":"","lang":"en"}],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"WSO2 API Manager","vendor":"WSO2","versions":[{"lessThan":"4.0.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"4.0.0.298","status":"affected","version":"4.0.0","versionType":"custom"},{"lessThan":"4.2.0.95","status":"affected","version":"4.2.0","versionType":"custom"},{"lessThan":"4.3.0.13","status":"affected","version":"4.3.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Identity Server","vendor":"WSO2","versions":[{"lessThan":"5.11.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"5.11.0.348","status":"affected","version":"5.11.0","versionType":"custom"},{"lessThan":"6.0.0.194","status":"affected","version":"6.0.0","versionType":"custom"},{"lessThan":"6.1.0.162","status":"affected","version":"6.1.0","versionType":"custom"},{"lessThan":"7.0.0.33","status":"affected","version":"7.0.0","versionType":"custom"}]},{"defaultStatus":"unknown","packageName":"org.wso2.carbon.identity.mgt","product":"WSO2 Carbon Identity Management","vendor":"WSO2","versions":[{"lessThan":"5.18.187.259","status":"affected","version":"5.18.187","versionType":"custom"},{"lessThan":"5.23.8.180","status":"affected","version":"5.23.8","versionType":"custom"},{"lessThan":"5.24.8.5","status":"affected","version":"5.24.8","versionType":"custom"},{"lessThan":"5.25.92.84","status":"affected","version":"5.25.92","versionType":"custom"},{"lessThan":"5.25.705.5","status":"affected","version":"5.25.705","versionType":"custom"},{"lessThan":"7.0.78.19","status":"affected","version":"7.0.78","versionType":"custom"}]},{"defaultStatus":"unknown","packageName":"org.wso2.carbon:org.wso2.carbon.user.core","product":"WSO2 Carbon User Manager Kernel","vendor":"WSO2","versions":[{"lessThan":"4.6.1.114","status":"affected","version":"4.6.1","versionType":"custom"},{"lessThan":"4.7.1.53","status":"affected","version":"4.7.1","versionType":"custom"},{"lessThan":"4.8.1.16","status":"affected","version":"4.8.1","versionType":"custom"},{"lessThan":"4.9.0.58","status":"affected","version":"4.9.0","versionType":"custom"},{"lessThan":"4.9.26.7","status":"affected","version":"4.9.26","versionType":"custom"},{"lessThan":"4.10.9.17","status":"affected","version":"4.10.9","versionType":"custom"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"4.0.0.298","versionStartIncluding":"4.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"4.2.0.95","versionStartIncluding":"4.2.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"4.3.0.13","versionStartIncluding":"4.3.0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*","versionEndExcluding":"5.11.0.348","versionStartIncluding":"5.11.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*","versionEndExcluding":"6.0.0.194","versionStartIncluding":"6.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.0.162","versionStartIncluding":"6.1.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*","versionEndExcluding":"7.0.0.33","versionStartIncluding":"7.0.0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_management:*:*:*:*:*:*:*:*","versionEndExcluding":"5.18.187.259","versionStartIncluding":"5.18.187","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_management:*:*:*:*:*:*:*:*","versionEndExcluding":"5.23.8.180","versionStartIncluding":"5.23.8","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_management:*:*:*:*:*:*:*:*","versionEndExcluding":"5.24.8.5","versionStartIncluding":"5.24.8","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_management:*:*:*:*:*:*:*:*","versionEndExcluding":"5.25.92.84","versionStartIncluding":"5.25.92","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_management:*:*:*:*:*:*:*:*","versionEndExcluding":"5.25.705.5","versionStartIncluding":"5.25.705","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_management:*:*:*:*:*:*:*:*","versionEndExcluding":"7.0.78.19","versionStartIncluding":"7.0.78","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:wso2_carbon_user_manager_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"4.6.1.114","versionStartIncluding":"4.6.1","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_user_manager_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"4.7.1.53","versionStartIncluding":"4.7.1","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_user_manager_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"4.8.1.16","versionStartIncluding":"4.8.1","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_user_manager_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"4.9.0.58","versionStartIncluding":"4.9.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_user_manager_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"4.9.26.7","versionStartIncluding":"4.9.26","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_user_manager_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"4.10.9.17","versionStartIncluding":"4.10.9","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The account lock feature fails to correctly enforce account lockouts on the primary user store when users with identical usernames exist in both primary and secondary user stores. This occurs because the lock condition is only applied to the secondary user store account in such scenarios, allowing continued authentication attempts against the primary user store account.\n\nThis functional flaw enables brute force attacks. By systematically attempting different passwords against the primary user store account, an attacker can potentially gain unauthorized access to sensitive information or accounts, as the intended account lockout mechanism does not prevent repeated login attempts."}],"value":"The account lock feature fails to correctly enforce account lockouts on the primary user store when users with identical usernames exist in both primary and secondary user stores. This occurs because the lock condition is only applied to the secondary user store account in such scenarios, allowing continued authentication attempts against the primary user store account.\n\nThis functional flaw enables brute force attacks. By systematically attempting different passwords against the primary user store account, an attacker can potentially gain unauthorized access to sensitive information or accounts, as the intended account lockout mechanism does not prevent repeated login attempts."}],"impacts":[{"capecId":"CAPEC-210","descriptions":[{"lang":"en","value":"CAPEC-210 CAPEC-210: Brute Force Attack"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-799","description":"CWE-799: Improper Neutralization of Input During Action Execution ('Code Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-02T06:13:53.229Z","orgId":"ed10eef1-636d-4fbe-9993-6890dfa878f8","shortName":"WSO2"},"references":[{"tags":["vendor-advisory"],"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3414/"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<span style=\"background-color: transparent;\">Follow the instructions given on </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3414/#solution\"><span style=\"background-color: transparent;\">https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3414/#solution</span></a> <br>"}],"value":"Follow the instructions given on  https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3414/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3414/#solution"}],"source":{"advisory":"WSO2-2024-3414","discovery":"INTERNAL"},"title":"Account Lock Bypass via User Store Synchronization in Multiple WSO2 Products Allows Brute Force Attacks","x_generator":{"engine":"Vulnogram 0.2.0"}}},"cveMetadata":{"assignerOrgId":"ed10eef1-636d-4fbe-9993-6890dfa878f8","assignerShortName":"WSO2","cveId":"CVE-2024-5617","datePublished":"2026-11-02T05:57:28.711Z","dateReserved":"2024-06-04T06:07:32.224Z","dateUpdated":"2026-11-02T06:13:53.229Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-02 06:17:41","lastModifiedDate":"2026-11-02 06:17:41","problem_types":["CWE-799","CWE-799 CWE-799: Improper Neutralization of Input During Action Execution ('Code Injection')"],"metrics":{"cvssMetricV31":[{"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":2.5}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2024","CveId":"5617","Ordinal":"1","Title":"Account Lock Bypass via User Store Synchronization in Multiple W","CVE":"CVE-2024-5617","Year":"2024"},"notes":[{"CveYear":"2024","CveId":"5617","Ordinal":"1","NoteData":"The account lock feature fails to correctly enforce account lockouts on the primary user store when users with identical usernames exist in both primary and secondary user stores. This occurs because the lock condition is only applied to the secondary user store account in such scenarios, allowing continued authentication attempts against the primary user store account.\n\nThis functional flaw enables brute force attacks. By systematically attempting different passwords against the primary user store account, an attacker can potentially gain unauthorized access to sensitive information or accounts, as the intended account lockout mechanism does not prevent repeated login attempts.","Type":"Description","Title":"Account Lock Bypass via User Store Synchronization in Multiple W"}]}}}